GRC conference 2026 showed AI governance is becoming continuous

At a glance

What this is: This conference recap argues that AI, data and risk governance are converging around continuous, data-centric assurance rather than static control checks.

Why it matters: It matters to IAM and security practitioners because AI decisions, data access and assurance evidence increasingly depend on the same governance controls, especially where human and non-human identities can act on sensitive data.

By the numbers:

• The conference brought together more than 50 speakers and 65 exhibitors to discuss emerging risks, regulations and GRC fundamentals.

👉 Read Ground Labs' conference recap on AI governance, data and risk convergence

Context

AI governance is no longer a narrow policy exercise. In practice, it now sits alongside data governance, cybersecurity, privacy and assurance because the same data, controls and evidence patterns underpin all of them. For identity and security teams, that convergence matters wherever human users, service accounts or AI agents can access sensitive data.

The conference message was that static annual reviews cannot keep pace with cloud and AI environments that change continuously. That is especially relevant where access decisions, delegated actions and data flows are increasingly machine-mediated, because governance now has to prove control effectiveness over time, not just policy intent.

Key questions

Q: How should organisations govern AI systems that can make consequential decisions?

A: Organisations should govern consequential AI systems with the same discipline used for high-risk identities: defined ownership, least privilege, logging, approval boundaries, and human override. The critical requirement is to connect model behaviour to real access paths so legal review, security review, and audit evidence all describe the same system.

Q: Why do data governance and AI governance need to be connected?

A: Because AI systems depend on data quality, data location and data access, so weak data governance creates blind spots in both model risk and privacy exposure. When organisations cannot see what data exists or who can reach it, they cannot credibly explain or assure AI-supported outcomes. Data governance becomes the control plane for trustworthy AI.

Q: How do you know if continuous assurance is actually working?

A: You know it is working when the evidence is current, control failures are detected before audit cycles and risk reports show change over time rather than only control existence. If assessments still depend on annual snapshots, the programme is not truly continuous. Effective assurance produces live signals, not retrospective comfort.

Q: Who should be accountable for AI agent actions in enterprise systems?

A: Accountability should sit with the team that owns the agent, its policies, and the connected tools, not only with the person who typed the original prompt. When a software actor can send messages, update records, and move data across systems, responsibility must follow the governed identity and its enforcement layer.

Technical breakdown

AI governance is moving from policy to operational accountability

AI governance starts as policy, but operational risk emerges when organisations must assign ownership for AI-supported decisions, explain those decisions and evidence the controls behind them. Agentic AI raises the bar because a system can act, chain actions and consume data without a human at each step. That turns governance into a runtime issue, not a document review exercise. In identity terms, the question becomes who or what is authorised to decide, use data and trigger downstream actions, and under what constraints.

Practical implication: Map decision ownership, data access and evidence collection to the specific systems making AI-supported decisions, not just to policy owners.

Data governance is the control plane for AI and privacy risk

Data governance is not a supporting discipline in AI environments. It is the foundation that tells teams what data exists, where it resides, how sensitive it is, who can access it and where it flows. Without that visibility, AI assurance, privacy compliance and security monitoring all become incomplete. For identity programmes, this creates a direct link between access governance and data governance because the identities that can reach sensitive data effectively define the blast radius of both AI misuse and privacy exposure.

Practical implication: Tie data classification and access governance together so privileged users, service accounts and AI workloads are assessed against the data they can actually reach.

Continuous assurance is replacing point-in-time control checks

Annual reviews are increasingly misaligned with cloud and AI environments because controls drift faster than assessment cycles. Continuous assurance means teams need current evidence that controls are working, not just snapshots that they existed on a given date. That shifts the governance problem from audit preparation to operational telemetry, especially for access, change and data-use controls. In practice, the more dynamic the identity model, the less value there is in relying on infrequent attestations alone.

Practical implication: Replace static attestations with control monitoring that can show whether access, classification and approval controls are still effective as environments change.

NHI Mgmt Group analysis

AI governance debt is now a board-level risk: organisations that treat AI governance as a policy artefact accumulate invisible exposure because accountability, evidence and runtime control never fully converge. The article reflects a wider pattern in which AI moves from experimentation into decision support and execution without governance architecture keeping pace. For practitioners, the discipline is to govern the decision path, not just the model policy.

Data-centric governance is the named concept this conference makes unavoidable: AI, privacy and cyber controls increasingly fail or succeed on the same data inventory, classification and access model. That means governance teams cannot separate AI oversight from data discovery or identity control. If sensitive data is not visible, accountable and scoped to the right identities, every downstream assurance claim weakens.

Continuous assurance is becoming the only credible evidence model: static control assessments cannot describe risk in environments where permissions, data paths and AI workflows change daily. This changes the standard from point-in-time compliance to evidence over time, which is much closer to how identity governance already thinks about access lifecycle, exception handling and privilege drift. Practitioners should expect audit expectations to move in that direction.

Agentic AI turns governance into an identity problem as well as a control problem: once AI systems can take actions, they need identity, authority boundaries and monitoring just like any other privileged actor. That does not mean treating them as people. It means recognising that machine-driven decisions can create real operational impact, so governance must cover delegated authority, data reach and revocation paths. Teams should adapt IAM and assurance models before autonomous behaviour becomes routine.

Integrated risk governance will favour programmes that can connect security, privacy and assurance evidence: the article points toward coordinated risk reporting built on shared data intelligence rather than siloed control narratives. That is a practical advantage for identity programmes, because entitlement, data access and exception reporting can be tied together. Practitioners should design for cross-domain evidence reuse, not isolated compliance outputs.

What this signals

Data-centric governance is becoming the organising model for identity programmes: once AI systems, service accounts and human users all touch the same sensitive data, access governance and data discovery can no longer be treated separately. That is where the NHI Lifecycle Management Guide becomes relevant, because lifecycle control is what translates entitlement policy into measurable operational scope.

The governance gap is no longer whether a control exists, but whether it can prove effectiveness as data flows and access paths change. That aligns closely with NIST Cybersecurity Framework 2.0 and with identity-centric evidence models that must show control performance over time.

Continuous assurance should now be treated as a programme design principle: organisations that still rely on annual attestation for AI, data and privilege governance will struggle to explain current risk. The practical shift is toward live visibility, linked evidence and explicit ownership for both human and non-human access paths.

For practitioners

• Build an AI decision ownership map Assign named owners for AI-supported decisions, the data they consume and the controls that validate those decisions over time.
• Unify data discovery with access governance Link classification, access rights and sensitive data location so that identity reviews reflect the actual data blast radius.
• Move from annual review to continuous evidence Instrument controls so teams can show current effectiveness for access, change and data-use controls instead of relying on yearly snapshots.
• Treat agentic AI as a governed actor class Define authority boundaries, monitoring points and revocation paths for AI systems that can independently take actions on enterprise data.
• Connect assurance reporting across domains Reuse the same evidence set for security, privacy, audit and risk reporting where possible, especially for sensitive data access and privilege drift.

Key takeaways

• The article’s central message is that AI governance, data governance and assurance are converging into one operating model.
• Static reviews are losing value because cloud and AI environments change faster than point-in-time governance can capture.
• Identity teams should focus on ownership, data reach and continuous evidence, because those controls now shape how AI risk is governed.

Key terms

• Continuous Assurance: A control model that checks identity and security conditions continuously instead of only during scheduled audits. It improves readiness in dynamic environments, but it requires clear thresholds, exception handling, and human accountability so automation does not outpace governance.
• Data-Centric Governance: Data-centric governance is an operating model that places the data itself at the centre of security, access, and compliance decisions. Instead of relying only on network or platform boundaries, it ties control decisions to sensitivity, location, duplication, and the identities that can reach each dataset.
• AI-assisted decisioning: AI-assisted decisioning is the use of machine learning or generative models to inform or automate risk judgments. For fraud programmes, the key issue is not whether AI is used, but whether its outputs are explainable, tunable, and governed with clear escalation paths when the model is wrong.
• Agentic AI: Autonomous AI systems capable of planning, deciding, and taking actions — including calling APIs, writing code, and orchestrating other agents — with minimal human oversight. Agentic AI introduces new NHI risks as agents must authenticate to external services.

What's in the full article

Ground Labs' full blog post covers the operational detail this post intentionally leaves at the governance level:

• The specific conference themes and session context behind the AI governance and data governance convergence.
• The practical framing Ground Labs used for data discovery, classification and assurance in cloud, on-premises and endpoint environments.
• The event-app and attendee hub references for reviewing the underlying session material and conference takeaways.
• The product and service context for how Ground Labs positions data intelligence in governance workflows.

👉 The full Ground Labs post expands on the conference themes, session context and data-centric governance angle.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security and lifecycle control. It is designed for practitioners who need to connect identity governance to broader security and assurance programmes.